HackingTechnologyInformationStolen CredentialsData ExfiltratedPIIIdentity (basic)LowContained

ACR Electronics, Inc

bd_427edf806494a0cc · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 12, 2023

Filed

Mar 14, 2024

To disclose

22 weeks

Affected

1state residents only

Linked

6 filings

Confidence

66%

Full breach record for ACR Electronics, Inc →

ACR Electronics, Inc. notified Montana residents of a data security incident discovered on October 12, 2023, involving unauthorized access to files containing personal information. The company engaged cybersecurity experts, notified the FBI, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 weeks / 154 days

Oct 12, 2023

Begins

Oct 12, 2023

Discovered

Mar 14, 2024

Filed

vs. sector median

+3 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_d593a13a38bf440b2024-03-14Candidate
New Hampshire State AGbd_ecf3c4ae3f77828a2024-03-14Verified
Massachusetts State AGbd_08e5b80aaf23a2c22024-03-15 · +1dVerified
New Hampshire State AGbd_1eb86e5e4db7933e2024-03-22 · +8dVerified

Show 1 more filing ↓up to 30d gap

Vermont State AGbd_3c46d917bd06aa1e2024-02-13 · +30dVerified

Name: ACR Electronics, Inc
norm: acr electronics

Name: ACR Electronics, Inc
norm: acr electronics
Industry: Technologyllm

Discovered: Oct 12, 2023
Breach occurred: Oct 12, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 12, 2024
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Engaged cybersecurity experts to assist with the process
Notified the Federal Bureau of Investigation
Offered complimentary credit monitoring and identity protection services through IDX
Changes made: Implemented measures to enhance network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(154 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Vermont State AGFeb 13 · first

Maine State AG+30d

New Hampshire State AG+30d

Montana State AG+30d · this page

Massachusetts State AG+31d

New Hampshire State AG+38d

Pattern: first filing Feb 13 (VT), last Mar 22 (NH) — a 38-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1189.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 14, 2024
Raw hash: 9f4aa72f63d95efc2d0fcf28f968d7a3948392ab87b314ac511893123ff1883f

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityACR Electronics, Inc

Victim entityACR Electronics, Inc

Incidentdiscovered Oct 12, 2023

Stated responseEngaged cybersecurity experts to assist with the process

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov